The 2013 two-step-verification bypass: a duplicate email defeated Dropbox 2FA

In July 2013 a team from Qatar's Q-CERT documented a way to bypass Dropbox's two-step verification. Security Affairs — 'DropBox account hacking bypassing two-factor authentication' reported that researcher Zouheir Abdallah 'revealed that an attacker already knows the victim's credentials (username and password obtained with a Key-logger, cross-site shared password, due the adoption of a easy to guess password etc..), for Dropbox account that has two-factor authentication enabled, is able to hack that account following the described procedure.' The flaw rested on the fact that Dropbox did not require email-address verification when creating an account: 'The flaw is related to the lack of verification of authenticity of the email addresses used to sign up a new DropBox account, a hacker could conduct the attack creating a new fake account similar to the target one and append a dot (.) anywhere in the email address.' The Hacker News — 'Hacking DropBox account, Vulnerability allows hacker to bypass Two-Factor Authentication' put the same point plainly: 'DropBox does not verify the authenticity of the email addresses used to Sign up a new account, so to exploit this flaw hacker just need to create a new fake account similar to the target's account and append a dot (.) anywhere in the email address.'

By enabling two-step verification on that fake, near-duplicate account, the attacker obtained an emergency backup code — Security Affairs explained that 'the attacker has to enable two-factor authentication for the fake account he created to obtain the emergency code generated at the end of the process,' a code 'DropBox users' can normally use 'to disable two factor authentication from his account in case of loss or theft.' That code could then be used against the genuine account: after logging in with the victim's real password, 'the Dropbox victim's account will request submission of the OTP code, but at this point the hacker will simulate the lost of device choosing the option "I Lost My Phone" from the authentication screen.' The Hacker News described the same last step from the attacker's perspective: 'Because 2-Factor authentication was enabled for victim's account, so website will ask to enter the OTP code. Leave it, just choose "I Lost My Phone" from the same screen. You will be prompted to use the "Emergency Code", that can disable the 2-Factor authentication.'

Submitting that code — generated from the attacker's own fake account, not the victim's — disabled the real account's two-step verification outright. As Security Affairs summarized: 'Submitting the "Emergency Code" the attacker could disable the two-factor authentication, but the flaws allow the him to use the emergency code generated using the fake account to disable two-Factor authentication for the victim's account.' The technique still required prior knowledge of the victim's password, but it undercut the very protection users had enabled specifically to defend against password compromise.